[1.4.x] Fixed #19756 - Corrected a ManyToMany example and added some links and markup.

Backport of 43efefae69 from master
[1.4.x] Fixed #19645 -- Added tests for TransactionMiddleware

Backpatch of f556df90be995a83b979cf875705d98521ab4dc7. Backpatching
these tests so that it will be easier to backpatch the fix for #19707.
[1.4.x] Fixed #19707 -- Reset transaction state after requests

Backpatch of a4e97cf315142e61bb4bc3ed8259b95d8586d09c.
[1.4.x] Made custom m2m fields without through easier to use

The change in f105fbe52b21da206bfbaedf0e92326667d7b2d4 made through=None
m2m fields fail in cases where they worked before. It isn't possible to
create such fields using public APIs. The fix is trivial, so it seems
worth fixing this for custom m2m field users.

This is not a backport from master. Master has gotten enough other
changes to related fields internal API that this fix alone isn't enough
to do any good.
Fixed WSGIPythonPath instruction in deployment docs

Partial backport of 3abf6105b6 from master. Refs #19042.
[1.4.x] Removed try-except in django.db.close_connection()

The reason was that the except clause needed to remove a connection
from the django.db.connections dict, but other parts of Django do not
expect this to happen. In addition the except clause was silently
swallowing the exception messages.

Refs #19707, special thanks to Carl Meyer for pointing out that this
approach should be taken.
[1.4.x] Fixed #19815 - Removed an unused import in tutorial 3.

Thanks pedro.calcao@ for the report.
[1.4.x] Fixed #19719 - Removed misleading example from ModelForm documentation

Backport of 976dc07baf from master
[1.4.x] Fixed #19812 - Removed a duplicate phrase in the widget docs.

Thanks diegueus9 for the report and itsallvoodoo for the draft patch.

Backport of 7a80904b00 from master
[1.4.x] Fixed #19824 - Corrected the class described for Field.primary_key from IntegerField to AutoField.

Thanks Keryn Knight.

Backport of 218bbef0c4 from master
[1.4.x] Added ALLOWED_HOSTS setting for HTTP host header validation.

This is a security fix; disclosure and advisory coming shortly.
[1.4.x] Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.

This is a security fix. Disclosure and advisory coming shortly.
[1.4.x] Checked object permissions on admin history view.

This is a security fix. Disclosure and advisory coming shortly.

Patch by Russell Keith-Magee.
[1.4.x] Added a default limit to the maximum number of forms in a formset.

This is a security fix. Disclosure and advisory coming shortly.
[1.4.x] Update 1.4.4 release notes for all security fixes.
[1.4.x] Bump version numbers for security release.
[1.4.x] Don't characterize XML vulnerabilities as DoS-only.
[1.4.x] Fixed #19857 -- Fixed broken docs link in project template.
[1.4.x] Note that ALLOWED_HOSTS default changes in Django 1.5.
[1.4.x] Bump version numbers to roll a clean package.